"Problem replicating config (bundle) to search peer...timed out; exceeded 60 sec" How do I resolve this error?

[kaskirana01]

Problem replicating config (bundle) to search peer '10.215.3.196:8089',Reading reply to upload: rv=-2, Receive from=https://10.215.3.196:8089 timed out; exceeded 60 sec, as per=distsearch.conf/[replicationSettings]/sendRcvTimeout.

I have changed the sendRcvTimeout to 120. Still I am getting the error. Someone please help me

[saravanan90]

We can reduce the bundle size (or) increase the bundle replication time.

To reduce the bundle size check in search head for the .bundle file in $SPLUNK_HOME/var/run/ and check for futile files.

To increase the bundle replication time add the below parameter in search head. By default the value is 60 seconds.

In distsearch.conf

[replicationSettings]
sendRcvTimeout = 120

[mattcaffeine · Accepted solution]

Have you checked the size of your bundle? It may be that it's simply too large to replicate in a timely manner. If you have large lookup files in the bundle you might consider blacklisting them or if they're required, then consider mounting your search bundle if your setup will allow for it.